CVE-2026-48581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48581", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-05-21T20:00:35.246Z", "datePublished": "2026-07-14T17:05:46.776Z", "dateUpdated": "2026-11-10T22:36:24.979Z"}, "containers": {"cna": {"title": "Surface Broker SDMA Elevation of Privilege Vulnerability", "datePublic": "2026-07-14T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_windows_dev_kit:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_hub:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_laptop_go_2:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_laptop_4_AMD_processor:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_go_2:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_laptop_4_intel_processor:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_pro_8:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_laptop_go_3:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_go_3:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:h:microsoft:surface_pro_7:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Surface Go", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Hub", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Laptop Go", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Laptop Go 3", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Pro", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Pro 8", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Surface Laptop 4 with AMD Processor", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Surface Laptop 4 with Intel Processor", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Surface Windows Dev Kit", "versions": [{"version": "-", "status": "affected"}]}], "descriptions": [{"value": "Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-1220: Insufficient Granularity of Access Control", "lang": "en-US", "type": "CWE", "cweId": "CWE-1220"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T22:36:24.979Z"}, "references": [{"name": "Surface Broker SDMA Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-48581"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T03:55:54.137Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48581", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T17:45:08.772218Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T17:45:09.739Z"}}], "cna": {"title": "Surface Broker SDMA Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Surface Go", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Hub", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Laptop Go", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Laptop Go 3", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Pro", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Surface Pro 8", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Surface Laptop 4 with AMD Processor", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Surface Laptop 4 with Intel Processor", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Surface Windows Dev Kit", "versions": [{"status": "affected", "version": "-"}]}], "datePublic": "2026-07-14T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581", "name": "Surface Broker SDMA Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_windows_dev_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_hub:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_laptop_go_2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_AMD_processor:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_go_2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_intel_processor:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_pro_8:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_laptop_go_3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_go_3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:h:microsoft:surface_pro_7:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T22:36:24.979Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48581", "state": "PUBLISHED", "dateUpdated": "2026-11-10T22:36:24.979Z", "dateReserved": "2026-05-21T20:00:35.246Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-07-14T17:05:46.776Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Microsoft Surface Go", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Microsoft Surface Hub", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Microsoft Surface Laptop Go", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Microsoft Surface Laptop Go 3", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Microsoft Surface Pro", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Microsoft Surface Pro 8", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Surface Laptop 4 with AMD Processor", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Surface Laptop 4 with Intel Processor", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}, {"product": "Surface Windows Dev Kit", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_go_2_1901_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "1CEF91B1-F29A-4F81-BAC9-6B93BBC5D749", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_go_2_1901:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F33EDF2-9058-4329-BBF6-2FCE80433F5B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_go_2_1926_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "FA077CA3-7A69-4226-AAD8-2BC199961704", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_go_2_1926:-:*:*:*:*:*:*:*", "matchCriteriaId": "80BE3894-3006-48E4-8DE9-9B059A05DCC4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_go_2_1927_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "1549BEF0-C1C6-4D1A-9662-1FB6672DBF69", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_go_2_1927:-:*:*:*:*:*:*:*", "matchCriteriaId": "32B48180-38CB-4C0E-BAF0-B99ACE575CFC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_go_3_1901_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "3CB6A413-CB85-4A53-B851-20CD13B93688", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_go_3_1901:-:*:*:*:*:*:*:*", "matchCriteriaId": "BD1750C1-2FDE-4A84-81D8-F57DE7E24974", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_go_3_1926_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "6CF69EC7-C430-48EA-8E4F-3C392D1AFCA3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_go_3_1926:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8EA8E7D-17E8-4E7A-B4A4-A208DC329FDB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_go_3_2022_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "222EC78A-597B-4D14-BE1F-82102C0BB0B4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_go_3_2022:-:*:*:*:*:*:*:*", "matchCriteriaId": "21C3A91A-3394-45DE-8932-5431EE8BFC99", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_hub_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "0A0398BF-8B4A-438D-95AA-25A33EEFE564", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_hub:-:*:*:*:*:*:*:*", "matchCriteriaId": "17351901-024F-4B03-AA84-67372C703301", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_hub_2s_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "0373B077-9CDC-4D56-9180-53DD54D6C3D8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_hub_2s:-:*:*:*:*:*:*:*", "matchCriteriaId": "5126D18E-4EFC-43CF-8243-895034C8FADC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_hub_2s_85_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF8F1CF9-94CF-4634-9851-65CF1C67A6AC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_hub_2s_85:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6D8102C-03E0-49E9-BA39-0F72E30C6304", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_hub_3_50_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "EECA9AFD-5144-4B18-B4EF-DF1541FC9564", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_hub_3_50:-:*:*:*:*:*:*:*", "matchCriteriaId": "3F56EC8E-E144-4D8F-B224-A7E6FA659437", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_hub_3_85_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5A3A16E8-2056-4650-BE5C-30B84E2AB848", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_hub_3_85:-:*:*:*:*:*:*:*", "matchCriteriaId": "14066FEE-0F3B-4271-BC68-80ECD53DA4DC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_go_1943_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5F819CA0-B611-43F8-86C1-7FC50F0E7756", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_go_1943:-:*:*:*:*:*:*:*", "matchCriteriaId": "C656EB1B-3FF8-404A-BFEA-77D2F25D90B4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_go_2_2013_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D3E5A4B2-EB1C-4036-A16C-6C142677B62B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_go_2_2013:-:*:*:*:*:*:*:*", "matchCriteriaId": "87A8AEDE-3268-4A57-823F-DCC09C526735", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_go_3_2013_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0901306-FBFE-4CBA-9C48-9842184219A9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_go_3_2013:-:*:*:*:*:*:*:*", "matchCriteriaId": "A06B6DD0-370E-4107-B4B7-0248317BB9A9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_pro_7\\+_1960_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "6EA0F116-7986-47A1-974A-E0F50376CA82", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_pro_7\\+_1960:-:*:*:*:*:*:*:*", "matchCriteriaId": "60D64C06-D141-49C7-956F-6FA3B108F752", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_pro_7\\+_with_lte_advanced_1961_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7C594D9-3193-4DAE-84C4-650E027A255D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_pro_7\\+_with_lte_advanced_1961:-:*:*:*:*:*:*:*", "matchCriteriaId": "59B147EE-718E-411B-A0F1-F077114236CC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_pro_8_1983_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "6E94C16E-94D9-4273-B8C8-BC57762F8367", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_pro_8_1983:-:*:*:*:*:*:*:*", "matchCriteriaId": "0A187D45-BB47-4667-ADFE-8B9E823F221B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_pro_8_for_business_1983_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "17896CFB-0B7D-456A-8A82-A971C3B5F072", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_pro_8_for_business_1983:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FBD2702-436C-4EB6-8F7F-4D65DFC9CCFA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_pro_8_for_business_with_lte_advanced_1982_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B2C9AC0B-1A29-4D57-A26D-AE7B8120EB19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_pro_8_for_business_with_lte_advanced_1982:-:*:*:*:*:*:*:*", "matchCriteriaId": "262D30D4-449E-47BB-9678-9F371B28DCF5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1979_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "53FAAED8-ECEA-4D23-8DBC-572D02D321E8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1979:-:*:*:*:*:*:*:*", "matchCriteriaId": "2EE6A4AC-189F-4FF4-9249-BA5198526BE5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1950_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5AA3D6B9-DD55-4CBD-A1E5-0737E3538A09", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1950:-:*:*:*:*:*:*:*", "matchCriteriaId": "D6C3A0E0-6485-411B-BC31-1A8A275CB034", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1951_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "81AE1FA8-DFE2-4C84-AE82-1CCB3EB2D807", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1951:-:*:*:*:*:*:*:*", "matchCriteriaId": "87E17267-FA93-4997-8D2D-8C0EB54BC932", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1952_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB6C780C-DDCE-447D-978C-57115EBBF4B9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1952:-:*:*:*:*:*:*:*", "matchCriteriaId": "6110417B-F51F-42B3-95F9-AD7D6398FED3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1953_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0E3E9CE-02B3-4CAC-B898-441206C0A9F5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1953:-:*:*:*:*:*:*:*", "matchCriteriaId": "D2F8D879-05EE-4C61-996C-C1A8D6692382", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1958_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "1DB5B208-C22B-4A1D-832C-29B693F35586", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1958:-:*:*:*:*:*:*:*", "matchCriteriaId": "2CD2054E-1098-4BEA-BA95-8430BF28192E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1959_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "37A535B1-733C-4D0D-B278-36D78296D1CA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1959:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BA4926B-3737-4E65-89D7-44993F87D68D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:surface_laptop_4_1978_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "EF2D920B-D1C3-4F79-AC91-14C3C61D7A0C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:surface_laptop_4_1978:-:*:*:*:*:*:*:*", "matchCriteriaId": "82E9E481-0326-4229-A8A7-84DE0D095425", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally."}], "id": "CVE-2026-48581", "lastModified": "2026-07-24T13:37:22.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48581", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-14T17:16:50.767", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1220"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{}

{"created": "2026-07-16T14:45:04.225466+00:00", "updated": "2026-07-31T09:15:06.109498+00:00", "vendors": []}